An improper check in the packet forwarding engine of Juniper Networks Junos OS on MX Series routers allows an unauthenticated, network‑based attacker to bypass firewall filters applied to non‑zero loopback interfaces (lo0.n, n≠0) that reside in the default routing instance. The filter is never executed, enabling traffic destined for the control‑plane to reach the device without restriction. This flaw, classified as CWE‑754, effectively removes a critical access‑control barrier.

The vulnerability affects Junipers’ MX Series routers with MPC10, MPC11, LC4800, LC9600 line‑cards, and MX304. All Junos OS releases before 23.2R2‑S6, before 23.4R2‑S7, before 24.2R2, and before 24.4R2 are susceptible. It occurs when a firewall filter is attached to a lo0 unit that is not referenced in any routing‑instance configuration, meaning it is placed in the default routing instance.

With a CVSS score of 6.9 and no EPSS data, the flaw is considered medium severity. Attackers need only network access to send traffic to the misconfigured lo0.n interface and do not require authentication, making exploitation straightforward for a nearby adversary. Since the control‑plane is exposed, an attacker could potentially access management interfaces or extract sensitive configuration if the device hosts critical network functions. The vulnerability is not listed in the CISA KEV catalog, but its impact warrants prompt remediation.